If you compromise the Gmail account of the person that controls all of them- quite realistic.

Pretty realistic. Compromises tend to be pretty far-reaching because often the weakest points are single points of failure for many system (email accounts especially).

Hmm, given that one of those is compromised, I'd say it's more likely that the rest are as well--Bayesian reasoning and all that. (Yeah, I don't actually know much about probability :P.)

People share passwords all the time. Also, if somebody's computer or email account was compromised, chances are that would also give up the credentials for all of the sites.

Their blog at least is running wordpress, from wordpress.com. It's possible that they did get compromised somewhere since all of the things seem to be external to them that they did get compromised and they weren't entirely aware of it right away because of the DDoSing. I can't imagine though that they can't have heard of this by now and aren't trying to do something about it if it's fake.

It's quite realistic. Or rather, the possibility that SendGrid's official Facebook, Twitter, blog, and status site all use the same password is quite realistic, and if that's the case then you only have to compromise one site to get them all.

They most likely share the same password so that multiple sendgrid employees can post to each of the pages.